Why VPC provides network isolation in AWS - Challenge Your Understanding

Challenge - 5 Problems

🧠 Conceptual

intermediate

How does a VPC isolate network traffic?

Which feature of a VPC ensures that resources inside it cannot communicate with resources outside unless explicitly allowed?

A The VPC assigns public IP addresses to all resources to isolate them.

B The VPC uses security groups and network ACLs to control inbound and outbound traffic.

C The VPC disables all routing tables to prevent any traffic flow.

D The VPC automatically encrypts all data between resources inside and outside the VPC.

💡 Hint

Think about how AWS controls which traffic is allowed in and out of a VPC.

VPC isolation is achieved by controlling traffic with security groups and network ACLs, which act like firewalls to allow or block traffic. Encryption and IP addressing alone do not isolate networks, and routing tables are necessary for traffic flow.

❓ Architecture

intermediate

VPC Subnet Isolation

What is the main reason subnets within a VPC can be isolated from each other?

A Each subnet has its own route table that controls traffic flow between subnets.

B Subnets use different IP address ranges that prevent communication.

C Subnets are physically separated in different data centers.

D Subnets automatically encrypt all traffic between them.

💡 Hint

Consider how routing controls traffic inside a VPC.

Subnets can be isolated by assigning different route tables that control which traffic is allowed between them. IP ranges alone do not prevent communication if routing allows it. Physical separation and encryption are not the main isolation methods.

❓ security

advanced

Effect of Network ACLs on VPC Isolation

What happens if a network ACL attached to a subnet denies all inbound traffic?

A No inbound traffic can reach any resource in that subnet, effectively isolating it.

B Only traffic from the internet is blocked, but internal VPC traffic is allowed.

C The subnet becomes publicly accessible despite the ACL settings.

D The network ACL settings are ignored if security groups allow traffic.

💡 Hint

Network ACLs act as stateless firewalls controlling traffic at the subnet level.

Network ACLs control inbound and outbound traffic at the subnet level. Denying all inbound traffic blocks all incoming packets, isolating the subnet. Security groups do not override network ACLs, and internal traffic is also affected.

❓ service_behavior

advanced

VPC Peering and Network Isolation

After creating a VPC peering connection between two VPCs, what must be done to allow resources in one VPC to communicate with the other?

A Create a VPN connection between the two VPCs.

B Enable public IP addresses on all instances in both VPCs.

C Disable security groups to allow unrestricted traffic.

D Update route tables in both VPCs to direct traffic through the peering connection.

💡 Hint

Think about how traffic knows where to go after peering is established.

VPC peering allows private IP communication, but route tables must be updated to send traffic through the peering link. Public IPs and VPNs are not required, and disabling security groups is insecure and unnecessary.

✅ Best Practice

expert

Ensuring Strong Network Isolation in Multi-Tenant VPCs

Which combination of configurations best ensures strong network isolation between tenants sharing a single VPC?

A Use a single subnet with open network ACLs and rely on tenant application-level firewalls.

B Assign public IPs to all tenant resources and rely on security groups only.

C Use separate subnets with dedicated route tables, strict network ACLs, and security groups per tenant.

D Disable all security groups and rely solely on network ACLs for isolation.

💡 Hint

Think about layered controls at subnet and instance levels.

Strong isolation requires multiple layers: separate subnets with route tables to control traffic flow, network ACLs to filter subnet traffic, and security groups to control instance-level access. Public IPs and open ACLs reduce isolation, and disabling security groups removes an important control layer.